Reporting

savedsearch builds table, then all the data disappears

fk319
Builder

I have a saved search that when I run the search manually, I get the data I expect. When I run it as a saved search, it populates the displayed table as expected and then it all dissapears when the job is completed. (todays search returns about 4000 records.) When I inspect the job, the last stats and eval are highlighted yellow.

index="csradmin" sourcetype="SI_PROD" user="*" succ="succ" type="*"
    (action="account_lookup" OR action="bind_device" OR action="reprov_device") 
| eval completed=if(action=="account_lookup","Attempted","Completed")
| eval installer=case(
    match(user,"tech*"), "Tech",
    user="cust", "Customer",
    0==0, "Netiher" )
| stats count(eval(completed="Attempted")) as com_at, count(eval(completed="Completed")) as com_cmp by act, installer, type
| eval com_at=max(com_at, com_cmp)

This is a common search that I need to further refine the data to build tables.

I have seen this behavior in the past, but it has been several months. In this case, I added a fields command to the end of the saved search, but it did not make a difference. Which I click on "Event List", instead of "Results Table", the expected logs are there.

Does anyone know why the table disappears and how to get it back?

Tags (1)
0 Karma
1 Solution

fk319
Builder

I opened a case with tech support and found that if I remove the extra line breaks in my saved search, things started to work.

View solution in original post

0 Karma

fk319
Builder

I opened a case with tech support and found that if I remove the extra line breaks in my saved search, things started to work.

0 Karma
Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...